Wi-Fi is the part where two things have to line up that you set in different places: the SSID table and the VLANs that carry it. On top of that RouterOS v7 has two Wi-Fi packages with different capabilities, and a few of these messages exist only to say which one you are on.
An error means it will not work. A warning is a decision you can defend. A note tells you what the script does, so you can recognise it.
An SSID on a VLAN that does not exist
SSID Guests refers to VLAN 30 which does not exist.
A warning that behaves like an error. The SSID is created and clients associate, but their traffic is tagged with a number nothing else knows, so it arrives nowhere. Add the VLAN to the table, or take the VLAN off the SSID so it uses the untagged network.
The access point does not carry the SSID VLAN
SSID Guests belongs on VLAN 30, but ap-02 does not carry that VLAN.
A warning, and the classic reason a guest network works on one access point and not on the other. The radio tags the traffic, the device has nowhere to send it. Add the VLAN to that access point, and check the switch port in front of it as well.
A network without a password
SSID Guests is open (no passphrase). and Relaying an open network means the repeater broadcasts openly too.
Warnings, and sometimes exactly what you want: a hotspot with a portal is an open network on purpose. If it was not on purpose, set WPA2 or WPA3 and a passphrase. An open network means everything in the air is readable by anyone in range.
WPA3 on the old wireless package
The legacy wireless package has no WPA3; the SSID is set up as WPA2-PSK (AES)., Legacy CAPsMAN has no WPA3; SSIDs become WPA2-PSK. and The legacy wireless package cannot do WPA3; it connects with WPA2-PSK (AES).
Warnings. You picked WPA3, the device runs the old wireless package, and the script falls back to WPA2 rather than generating something that will not load. The security is a step lower than you asked for. If the model supports the new wifi package, switching to it is the real fix.
The ports towards the access points have to be trunks
The ports towards the CAPs must be trunks with the SSID VLANs tagged (VLANs section › port assignment).
A warning about the other end of the work. CAPsMAN hands the access points their VLANs, but the cable in between has to carry those tags. An access port passes one network, so the guest SSID dies at the switch. Set the port to trunk and tag the Wi-Fi VLANs.
No controller address for a CAP
No controller address given: the access point looks for the controller by broadcast on bridge. That only works when controller and access point share the same layer-2 network.
A note. Discovery by broadcast is fine in a flat network and stops working the moment the access points sit in their own management VLAN and the controller does not. Filling in the controller address is one line and saves that surprise.
The controller decides, not this script
The radios are configured entirely by the controller. SSIDs, security and VLANs come from there, not from this script. Make sure the port towards this device carries the wifi VLANs tagged.
A note, so you do not go looking for SSIDs in a CAP script. A managed access point contains almost nothing: a bridge, an address and the pointer to its controller. Everything else arrives over the network.
A controller and standalone access points in one site
This site has a CAPsMAN controller, but these access points are set up as standalone: ap-01, ap-02. To manage them centrally, use the controller's CAP script instead.
A note about a common mix-up. Both work, but not together: standalone access points keep their own SSIDs and ignore the controller, so a change on the controller does not reach them. Pick one model for the whole site.
Not every access point broadcasts the same SSIDs
Not every access point broadcasts the same SSIDs. For roaming the name, security and passphrase have to match everywhere.
A note. A phone only walks from one access point to the next when it sees the same network, which means an identical name, identical security and an identical passphrase. Differences are allowed, and then you have two networks rather than one that covers the building.
Check that the Wi-Fi package is installed
Check that the wifi-qcom package is installed on this device.
A warning on models where we could not confirm which package ships. The script writes /interface wifi lines, and without that package RouterOS rejects them. Check with /system package print before you paste.
MLO with one radio in the group
MLO needs at least two radios in the group; with one band there is nothing to combine.
A warning, and it stops MLO from being generated at all. Multi-link means using several bands at the same time. With two or more radios in the group you get a note instead: MLO is on for wifi1 and wifi2. Only Wi-Fi 7 clients use it; older devices stay on the ordinary SSIDs. Leaving 2.4 GHz out of the group is usually right, for IoT and older equipment.
Station settings the new package does not have
The wifi package has no station-pseudobridge; station-bridge is used (requires a MikroTik AP). and BSSID locking is not a configuration option on the wifi package; the SSID is used.
Warnings about a choice that is quietly replaced. The new wifi package has a smaller set of client modes than the old one. Station-bridge only works towards a MikroTik, and without BSSID locking the device connects to whichever access point with that name is strongest.
Which repeater mode fits your upstream
station-bridge only works when the upstream router is a MikroTik running the same driver as this device (the new wifi package). If the other end runs the other package, or is another brand, pick station-pseudobridge instead., With station-pseudobridge every client sits behind one MAC address. If an older MikroTik is upstream, set /interface bridge set protocol-mode=none there or DHCP will stall. and There are reports that station-pseudobridge on RouterOS 7 does not work while RSTP is on the bridge. If it will not come up, set protocol-mode=none on this bridge (Bridge & ports section).
Warnings, and together they are the decision: MikroTik on the other side means station-bridge, anything else means pseudobridge with its one MAC address and its quirks. The last one is a forum report rather than documentation, which is why it is phrased as something to try.
A repeater that hands out addresses
The DHCP server is on while the repeater sits on the same layer-2 network: that puts two DHCP servers on one network. Turn it off and let the repeater get its own address over DHCP. and NAT does not belong on a repeater: traffic is bridged, not routed.
The first is an error, the second a warning. A repeater extends an existing network instead of making a new one, so addresses and NAT belong on the router. Two DHCP servers on one network give half your clients the wrong gateway. Switch both off and let the repeater take its own address over DHCP.
The same SSID upstream and down
Same SSID upstream and down: whether a client switches over is up to the client device itself. 802.11r/k/v do not help here, they do not work in this setup.
A note about what a repeater cannot do. With one name the phone decides for itself when to let go, and phones hold on for a long time. A separate name for the repeater gives you control at the cost of switching by hand.
Related: Wi-Fi settings, CAPsMAN and Roaming that works.